PT-2026-3877 · Docmost+1 · Docmost+1

Arthurgervais + 1 · Published 2026-01-21 · Updated 2026-02-17 · CVE-2026-23630

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions Docmost versions 0.3.0 through 0.23.2

Description Docmost is collaborative wiki and documentation software. Versions 0.3.0 through 0.23.2 are susceptible to stored Cross-Site Scripting (XSS) due to improper sanitization when rendering Mermaid code blocks. The mermaid.render() function is used to render diagrams, and the resulting SVG/HTML is injected into the Document Object Model (DOM) using dangerouslySetInnerHTML without appropriate sanitization. Mermaid’s %%{init}%% directives can override security settings and enable HTML labels, allowing arbitrary HTML and JavaScript execution for anyone viewing the diagrams.

Recommendations Update to version 0.24.0 or later.

Exploit

Fix

XSS

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-79

CWE-116

Related Identifiers

CVE-2026-23630

GHSA-R4HJ-MC62-JMWJ

Affected Products

Docmost

Mermaid

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23630.json · Exploit
• https://github.com/docmost/docmost/security/advisories/GHSA-r4hj-mc62-jmwj · Vendor Advisory
• https://github.com/docmost/docmost/commit/cb9f27da9a8b4940760e37e5238a1eb91e427daf · Patch
• https://osv.dev/vulnerability/CVE-2026-23630 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23630 · Security Note
• https://github.com/docmost/docmost/releases/tag/v0.24.0 · Note
• https://t.me/CVEtracker/42710 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2014199981641494699 · Twitter Post
• https://t.me/cveNotify/149491 · Telegram Post
• https://t.me/cveNotify/152207 · Telegram Post
• https://twitter.com/CVEnew/status/2014116175756566696 · Twitter Post